Automated Malware Analysis IOC Report for

Files

File Path

Type

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\jQ3NFDayJm.exe

"C:\Users\user\Desktop\jQ3NFDayJm.exe"

C:\Windows\SysWOW64\Enmknk32.exe

C:\Windows\system32\Enmknk32.exe

C:\Windows\SysWOW64\Fnohck32.exe

C:\Windows\system32\Fnohck32.exe

C:\Windows\SysWOW64\Fkchmojh.exe

C:\Windows\system32\Fkchmojh.exe

C:\Windows\SysWOW64\Fekmfd32.exe

C:\Windows\system32\Fekmfd32.exe

C:\Windows\SysWOW64\Foaacm32.exe

C:\Windows\system32\Foaacm32.exe

C:\Windows\SysWOW64\Fmeamaph.exe

C:\Windows\system32\Fmeamaph.exe

C:\Windows\SysWOW64\Ffmfeg32.exe

C:\Windows\system32\Ffmfeg32.exe

C:\Windows\SysWOW64\Febcfckp.exe

C:\Windows\system32\Febcfckp.exe

C:\Windows\SysWOW64\Gbfcph32.exe

C:\Windows\system32\Gbfcph32.exe

C:\Windows\SysWOW64\Gbipeg32.exe

C:\Windows\system32\Gbipeg32.exe

C:\Windows\SysWOW64\Gpmqolfa.exe

C:\Windows\system32\Gpmqolfa.exe

C:\Windows\SysWOW64\Geiigbeh.exe

C:\Windows\system32\Geiigbeh.exe

C:\Windows\SysWOW64\Gnbnph32.exe

C:\Windows\system32\Gnbnph32.exe

C:\Windows\SysWOW64\Gpajjk32.exe

C:\Windows\system32\Gpajjk32.exe

C:\Windows\SysWOW64\Genbbb32.exe

C:\Windows\system32\Genbbb32.exe

C:\Windows\SysWOW64\Hbbclf32.exe

C:\Windows\system32\Hbbclf32.exe

C:\Windows\SysWOW64\Hpfcejof.exe

C:\Windows\system32\Hpfcejof.exe

C:\Windows\SysWOW64\Hphpkjlc.exe

C:\Windows\system32\Hphpkjlc.exe

C:\Windows\SysWOW64\Hloapk32.exe

C:\Windows\system32\Hloapk32.exe

C:\Windows\SysWOW64\Iejbnp32.exe

C:\Windows\system32\Iejbnp32.exe

C:\Windows\SysWOW64\Iflknc32.exe

C:\Windows\system32\Iflknc32.exe

C:\Windows\SysWOW64\Ipdpfhbf.exe

C:\Windows\system32\Ipdpfhbf.exe

C:\Windows\SysWOW64\Ilkpkihj.exe

C:\Windows\system32\Ilkpkihj.exe

C:\Windows\SysWOW64\Imjmel32.exe

C:\Windows\system32\Imjmel32.exe

C:\Windows\SysWOW64\Ifcanaen.exe

C:\Windows\system32\Ifcanaen.exe

C:\Windows\SysWOW64\Jfenda32.exe

C:\Windows\system32\Jfenda32.exe

C:\Windows\SysWOW64\Jopbhd32.exe

C:\Windows\system32\Jopbhd32.exe

C:\Windows\SysWOW64\Jppobf32.exe

C:\Windows\system32\Jppobf32.exe

C:\Windows\SysWOW64\Jlfpghnm.exe

C:\Windows\system32\Jlfpghnm.exe

C:\Windows\SysWOW64\Jlimmg32.exe

C:\Windows\system32\Jlimmg32.exe

C:\Windows\SysWOW64\Kmhigjcm.exe

C:\Windows\system32\Kmhigjcm.exe

C:\Windows\SysWOW64\Kiojlk32.exe

C:\Windows\system32\Kiojlk32.exe

C:\Windows\SysWOW64\Kefjql32.exe

C:\Windows\system32\Kefjql32.exe

C:\Windows\SysWOW64\Kgegkoeh.exe

C:\Windows\system32\Kgegkoeh.exe

C:\Windows\SysWOW64\Kpnkcdli.exe

C:\Windows\system32\Kpnkcdli.exe

C:\Windows\SysWOW64\Kjfplj32.exe

C:\Windows\system32\Kjfplj32.exe

C:\Windows\SysWOW64\Ljimbj32.exe

C:\Windows\system32\Ljimbj32.exe

C:\Windows\SysWOW64\Leomgk32.exe

C:\Windows\system32\Leomgk32.exe

C:\Windows\SysWOW64\Lgojanmn.exe

C:\Windows\system32\Lgojanmn.exe

C:\Windows\SysWOW64\Lgaffm32.exe

C:\Windows\system32\Lgaffm32.exe

C:\Windows\SysWOW64\Llnood32.exe

C:\Windows\system32\Llnood32.exe

C:\Windows\SysWOW64\Ljbphh32.exe

C:\Windows\system32\Ljbphh32.exe

C:\Windows\SysWOW64\Mjdlnhfi.exe

C:\Windows\system32\Mjdlnhfi.exe

C:\Windows\SysWOW64\Mjgichdg.exe

C:\Windows\system32\Mjgichdg.exe

C:\Windows\SysWOW64\Mjieig32.exe

C:\Windows\system32\Mjieig32.exe

C:\Windows\SysWOW64\Mgmfbl32.exe

C:\Windows\system32\Mgmfbl32.exe

C:\Windows\SysWOW64\Mohkfn32.exe

C:\Windows\system32\Mohkfn32.exe

C:\Windows\SysWOW64\Mnikde32.exe

C:\Windows\system32\Mnikde32.exe

C:\Windows\SysWOW64\Njplifll.exe

C:\Windows\system32\Njplifll.exe

C:\Windows\SysWOW64\Nchpbl32.exe

C:\Windows\system32\Nchpbl32.exe

C:\Windows\SysWOW64\Nooagm32.exe

C:\Windows\system32\Nooagm32.exe

C:\Windows\SysWOW64\Nqomappc.exe

C:\Windows\system32\Nqomappc.exe

C:\Windows\SysWOW64\Nmenfa32.exe

C:\Windows\system32\Nmenfa32.exe

C:\Windows\SysWOW64\Oqcglo32.exe

C:\Windows\system32\Oqcglo32.exe

C:\Windows\SysWOW64\Ophcmlpf.exe

C:\Windows\system32\Ophcmlpf.exe

C:\Windows\SysWOW64\Oqhpgogi.exe

C:\Windows\system32\Oqhpgogi.exe

C:\Windows\SysWOW64\Omoalp32.exe

C:\Windows\system32\Omoalp32.exe

C:\Windows\SysWOW64\Onnmfb32.exe

C:\Windows\system32\Onnmfb32.exe

C:\Windows\SysWOW64\Onqjlb32.exe

C:\Windows\system32\Onqjlb32.exe

C:\Windows\SysWOW64\Pjgkac32.exe

C:\Windows\system32\Pjgkac32.exe

C:\Windows\SysWOW64\Pfnkfdne.exe

C:\Windows\system32\Pfnkfdne.exe

C:\Windows\SysWOW64\Pfqhkdkc.exe

C:\Windows\system32\Pfqhkdkc.exe

C:\Windows\SysWOW64\Pfceac32.exe

C:\Windows\system32\Pfceac32.exe

C:\Windows\SysWOW64\Pfeafc32.exe

C:\Windows\system32\Pfeafc32.exe

C:\Windows\SysWOW64\Qjcjma32.exe

C:\Windows\system32\Qjcjma32.exe

C:\Windows\SysWOW64\Qhgkff32.exe

C:\Windows\system32\Qhgkff32.exe

C:\Windows\SysWOW64\Apbpjhji.exe

C:\Windows\system32\Apbpjhji.exe

C:\Windows\SysWOW64\Aabldk32.exe

C:\Windows\system32\Aabldk32.exe

C:\Windows\SysWOW64\Ajjqmqgl.exe

C:\Windows\system32\Ajjqmqgl.exe

C:\Windows\SysWOW64\Apgieg32.exe

C:\Windows\system32\Apgieg32.exe

C:\Windows\SysWOW64\Amkiol32.exe

C:\Windows\system32\Amkiol32.exe

C:\Windows\SysWOW64\Ajojhp32.exe

C:\Windows\system32\Ajojhp32.exe

C:\Windows\SysWOW64\Bombon32.exe

C:\Windows\system32\Bombon32.exe

C:\Windows\SysWOW64\Bmbppkoe.exe

C:\Windows\system32\Bmbppkoe.exe

C:\Windows\SysWOW64\Baphfiel.exe

C:\Windows\system32\Baphfiel.exe

C:\Windows\SysWOW64\Bmgikj32.exe

C:\Windows\system32\Bmgikj32.exe

C:\Windows\SysWOW64\Badaah32.exe

C:\Windows\system32\Badaah32.exe

C:\Windows\SysWOW64\Cohbjm32.exe

C:\Windows\system32\Cohbjm32.exe

C:\Windows\SysWOW64\Cokoplnm.exe

C:\Windows\system32\Cokoplnm.exe

C:\Windows\SysWOW64\Cgfcdokh.exe

C:\Windows\system32\Cgfcdokh.exe

C:\Windows\SysWOW64\Ckdljm32.exe

C:\Windows\system32\Ckdljm32.exe

C:\Windows\SysWOW64\Chhmdaph.exe

C:\Windows\system32\Chhmdaph.exe

C:\Windows\SysWOW64\Dhjiianf.exe

C:\Windows\system32\Dhjiianf.exe

C:\Windows\SysWOW64\Dhmfoq32.exe

C:\Windows\system32\Dhmfoq32.exe

C:\Windows\SysWOW64\Dhocdp32.exe

C:\Windows\system32\Dhocdp32.exe

C:\Windows\SysWOW64\Dokhgj32.exe

C:\Windows\system32\Dokhgj32.exe

C:\Windows\SysWOW64\Dondlj32.exe

C:\Windows\system32\Dondlj32.exe

C:\Windows\SysWOW64\Encamf32.exe

C:\Windows\system32\Encamf32.exe

C:\Windows\SysWOW64\Eaqjcdhf.exe

C:\Windows\system32\Eaqjcdhf.exe

C:\Windows\SysWOW64\Engkhenj.exe

C:\Windows\system32\Engkhenj.exe

C:\Windows\SysWOW64\Eddpko32.exe

C:\Windows\system32\Eddpko32.exe

C:\Windows\SysWOW64\Fqjqpp32.exe

C:\Windows\system32\Fqjqpp32.exe

C:\Windows\SysWOW64\Fbjmjcpl.exe

C:\Windows\system32\Fbjmjcpl.exe

C:\Windows\SysWOW64\Fnanodfp.exe

C:\Windows\system32\Fnanodfp.exe

C:\Windows\SysWOW64\Fopjig32.exe

C:\Windows\system32\Fopjig32.exe

C:\Windows\SysWOW64\Fbacjbjc.exe

C:\Windows\system32\Fbacjbjc.exe

C:\Windows\SysWOW64\Gqfpko32.exe

C:\Windows\system32\Gqfpko32.exe

C:\Windows\SysWOW64\Ggbenh32.exe

C:\Windows\system32\Ggbenh32.exe

C:\Windows\SysWOW64\Gibahklh.exe

C:\Windows\system32\Gibahklh.exe

C:\Windows\SysWOW64\Gidnmk32.exe

C:\Windows\system32\Gidnmk32.exe

C:\Windows\SysWOW64\Gekobloj.exe

C:\Windows\system32\Gekobloj.exe

C:\Windows\SysWOW64\Hglhdg32.exe

C:\Windows\system32\Hglhdg32.exe

C:\Windows\SysWOW64\Hkjqjeba.exe

C:\Windows\system32\Hkjqjeba.exe

C:\Windows\SysWOW64\Hgqaofhe.exe

C:\Windows\system32\Hgqaofhe.exe

C:\Windows\SysWOW64\Hedahkgo.exe

C:\Windows\system32\Hedahkgo.exe

C:\Windows\SysWOW64\Hbhbbofi.exe

C:\Windows\system32\Hbhbbofi.exe

C:\Windows\SysWOW64\Ibkogn32.exe

C:\Windows\system32\Ibkogn32.exe

C:\Windows\SysWOW64\Inaplpij.exe

C:\Windows\system32\Inaplpij.exe

C:\Windows\SysWOW64\Iiiqoh32.exe

C:\Windows\system32\Iiiqoh32.exe

C:\Windows\SysWOW64\Ipfeaa32.exe

C:\Windows\system32\Ipfeaa32.exe

C:\Windows\SysWOW64\Jphbga32.exe

C:\Windows\system32\Jphbga32.exe

C:\Windows\SysWOW64\Jomohnom.exe

C:\Windows\system32\Jomohnom.exe

C:\Windows\SysWOW64\Jpmlbqfp.exe

C:\Windows\system32\Jpmlbqfp.exe

C:\Windows\SysWOW64\Jlclga32.exe

C:\Windows\system32\Jlclga32.exe

C:\Windows\SysWOW64\Jhjmlb32.exe

C:\Windows\system32\Jhjmlb32.exe

C:\Windows\SysWOW64\Jacaehhi.exe

C:\Windows\system32\Jacaehhi.exe

C:\Windows\SysWOW64\Khofgbnc.exe

C:\Windows\system32\Khofgbnc.exe

C:\Windows\SysWOW64\Khacmalp.exe

C:\Windows\system32\Khacmalp.exe

C:\Windows\SysWOW64\Konhokaj.exe

C:\Windows\system32\Konhokaj.exe

C:\Windows\SysWOW64\Kejmae32.exe

C:\Windows\system32\Kejmae32.exe

C:\Windows\SysWOW64\Lpbndndh.exe

C:\Windows\system32\Lpbndndh.exe

C:\Windows\SysWOW64\Lcbgfi32.exe

C:\Windows\system32\Lcbgfi32.exe

C:\Windows\SysWOW64\Lceckh32.exe

C:\Windows\system32\Lceckh32.exe

C:\Windows\SysWOW64\Lcgpahmc.exe

C:\Windows\system32\Lcgpahmc.exe

C:\Windows\SysWOW64\Mpkajllm.exe

C:\Windows\system32\Mpkajllm.exe

C:\Windows\SysWOW64\Mhibdn32.exe

C:\Windows\system32\Mhibdn32.exe

C:\Windows\SysWOW64\Mhkojn32.exe

C:\Windows\system32\Mhkojn32.exe

C:\Windows\SysWOW64\Mlihpl32.exe

C:\Windows\system32\Mlihpl32.exe

C:\Windows\SysWOW64\Njoeophq.exe

C:\Windows\system32\Njoeophq.exe

C:\Windows\SysWOW64\Nbkicbfk.exe

C:\Windows\system32\Nbkicbfk.exe

C:\Windows\SysWOW64\Nqnfgjlh.exe

C:\Windows\system32\Nqnfgjlh.exe

C:\Windows\SysWOW64\Ofmldphm.exe

C:\Windows\system32\Ofmldphm.exe

C:\Windows\SysWOW64\Ojkdkonc.exe

C:\Windows\system32\Ojkdkonc.exe

C:\Windows\SysWOW64\Ojmapnlq.exe

C:\Windows\system32\Ojmapnlq.exe

C:\Windows\SysWOW64\Ofdbeobd.exe

C:\Windows\system32\Ofdbeobd.exe

C:\Windows\SysWOW64\Offokopb.exe

C:\Windows\system32\Offokopb.exe

C:\Windows\SysWOW64\Pfikpo32.exe

C:\Windows\system32\Pfikpo32.exe

C:\Windows\SysWOW64\Pijdbj32.exe

C:\Windows\system32\Pijdbj32.exe

C:\Windows\SysWOW64\Pjiqlm32.exe

C:\Windows\system32\Pjiqlm32.exe

C:\Windows\SysWOW64\Pbdepo32.exe

C:\Windows\system32\Pbdepo32.exe

C:\Windows\SysWOW64\Pqhbdf32.exe

C:\Windows\system32\Pqhbdf32.exe

C:\Windows\SysWOW64\Qmocigko.exe

C:\Windows\system32\Qmocigko.exe

C:\Windows\SysWOW64\Qiecnhac.exe

C:\Windows\system32\Qiecnhac.exe

C:\Windows\SysWOW64\Amcldf32.exe

C:\Windows\system32\Amcldf32.exe

C:\Windows\SysWOW64\Ameiifeg.exe

C:\Windows\system32\Ameiifeg.exe

C:\Windows\SysWOW64\Ailjng32.exe

C:\Windows\system32\Ailjng32.exe

C:\Windows\SysWOW64\Ajlfhjbn.exe

C:\Windows\system32\Ajlfhjbn.exe

C:\Windows\SysWOW64\Bpkkfq32.exe

C:\Windows\system32\Bpkkfq32.exe

C:\Windows\SysWOW64\Bajhpc32.exe

C:\Windows\system32\Bajhpc32.exe

C:\Windows\SysWOW64\Bdkabo32.exe

C:\Windows\system32\Bdkabo32.exe

C:\Windows\SysWOW64\Bdnngnpc.exe

C:\Windows\system32\Bdnngnpc.exe

C:\Windows\SysWOW64\Baanabom.exe

C:\Windows\system32\Baanabom.exe

C:\Windows\SysWOW64\Bmhofc32.exe

C:\Windows\system32\Bmhofc32.exe

C:\Windows\SysWOW64\Cafglb32.exe

C:\Windows\system32\Cafglb32.exe

C:\Windows\SysWOW64\Cmmhacal.exe

C:\Windows\system32\Cmmhacal.exe

C:\Windows\SysWOW64\Cmoefb32.exe

C:\Windows\system32\Cmoefb32.exe

C:\Windows\SysWOW64\Cppnhn32.exe

C:\Windows\system32\Cppnhn32.exe

C:\Windows\SysWOW64\Dbagjiik.exe

C:\Windows\system32\Dbagjiik.exe

C:\Windows\SysWOW64\Dmihma32.exe

C:\Windows\system32\Dmihma32.exe

C:\Windows\SysWOW64\Dafpcpme.exe

C:\Windows\system32\Dafpcpme.exe

C:\Windows\SysWOW64\Dkoele32.exe

C:\Windows\system32\Dkoele32.exe

C:\Windows\SysWOW64\Dcjjpgaa.exe

C:\Windows\system32\Dcjjpgaa.exe

C:\Windows\SysWOW64\Ecmfegon.exe

C:\Windows\system32\Ecmfegon.exe

C:\Windows\SysWOW64\Edlcpjfa.exe

C:\Windows\system32\Edlcpjfa.exe

C:\Windows\SysWOW64\Ednpeidn.exe

C:\Windows\system32\Ednpeidn.exe

C:\Windows\SysWOW64\Edqlki32.exe

C:\Windows\system32\Edqlki32.exe

C:\Windows\SysWOW64\Eniqcohl.exe

C:\Windows\system32\Eniqcohl.exe

C:\Windows\SysWOW64\Fnkmiofi.exe

C:\Windows\system32\Fnkmiofi.exe

C:\Windows\SysWOW64\Fplfki32.exe

C:\Windows\system32\Fplfki32.exe

There are 160 hidden processes, click here to show them.

URLs

Name

Malicious

http://tat-neftbank.ru/kkq.phphttp://tat-neftbank.ru/wcmd.htmSoftware

unknown

Details

Name:	http://tat-neftbank.ru/kkq.phphttp://tat-neftbank.ru/wcmd.htmSoftware
TargetID:	0
From Memory:	true
Current Path:	C:\Users\user\Desktop\jQ3NFDayJm.exe
Source:	jQ3NFDayJm.exe, 00000000.00000002.1470739378.000000000042A000.00000004.00000001.01000000.00000003.sdmp, Enmknk32.exe, 00000001.00000002.1471644690.000000000042A000.00000004.00000001.01000000.00000004.sdmp, Fnohck32.exe, 00000002.00000002.1472452269.000000000042A000.00000004.00000001.01000000.00000005.sdmp, Fkchmojh.exe, 00000003.00000002.1473368979.000000000042A000.00000004.00000001.01000000.00000006.sdmp, Fekmfd32.exe, 00000005.00000002.1474183172.000000000042A000.00000004.00000001.01000000.00000007.sdmp, Foaacm32.exe, 00000006.00000002.1474948269.000000000042A000.00000004.00000001.01000000.00000008.sdmp, Fmeamaph.exe, 00000007.00000002.1476045755.000000000042A000.00000004.00000001.01000000.00000009.sdmp, Ffmfeg32.exe, 00000008.00000002.1477156948.000000000042A000.00000004.00000001.01000000.0000000A.sdmp, Febcfckp.exe, 00000009.00000002.1478417107.000000000042A000.00000004.00000001.01000000.0000000B.sdmp, Gbfcph32.exe, 0000000A.00000002.1479423300.000000000042A000.00000004.00000001.01000000.0000000C.sdmp, Gbipeg32.exe, 0000000B.00000002.1480045068.000000000042A000.00000004.00000001.01000000.0000000D.sdmp, Gpmqolfa.exe, 0000000C.00000002.1480873068.000000000042A000.00000004.00000001.01000000.0000000E.sdmp, Geiigbeh.exe, 0000000D.00000002.1481733667.000000000042A000.00000004.00000001.01000000.0000000F.sdmp, Gnbnph32.exe, 0000000E.00000002.1482343235.000000000042A000.00000004.00000001.01000000.00000010.sdmp, Gpajjk32.exe, 0000000F.00000002.1483379730.000000000042A000.00000004.00000001.01000000.00000011.sdmp, Genbbb32.exe, 00000010.00000002.1484294341.000000000042A000.00000004.00000001.01000000.00000012.sdmp, Hbbclf32.exe, 00000011.00000002.1485425782.000000000042A000.00000004.00000001.01000000.00000013.sdmp, Hpfcejof.exe, 00000012.00000002.1486750331.000000000042A000.00000004.00000001.01000000.00000014.sdmp, Hphpkjlc.exe, 00000013.00000002.1488083524.000000000042A000.00000004.00000001.01000000.00000015.sdmp, Hloapk32.exe, 00000014.00000002.1490631205.000000000042A000.00000004.00000001.01000000.00000016.sdmp, Iejbnp32.exe, 00000015.00000002.1492067196.000000000042A000.00000004.00000001.01000000.00000017.sdmp

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://tat-neftbank.ru/wcmd.htm

unknown

Details

Name:	http://tat-neftbank.ru/wcmd.htm
TargetID:	0
From Memory:	true
Current Path:	C:\Users\user\Desktop\jQ3NFDayJm.exe
Source:	jQ3NFDayJm.exe, 00000000.00000002.1470739378.000000000042A000.00000004.00000001.01000000.00000003.sdmp, Enmknk32.exe, 00000001.00000002.1471644690.000000000042A000.00000004.00000001.01000000.00000004.sdmp, Fnohck32.exe, 00000002.00000002.1472452269.000000000042A000.00000004.00000001.01000000.00000005.sdmp, Fkchmojh.exe, 00000003.00000002.1473368979.000000000042A000.00000004.00000001.01000000.00000006.sdmp, Fekmfd32.exe, 00000005.00000002.1474183172.000000000042A000.00000004.00000001.01000000.00000007.sdmp, Foaacm32.exe, 00000006.00000002.1474948269.000000000042A000.00000004.00000001.01000000.00000008.sdmp, Fmeamaph.exe, 00000007.00000002.1476045755.000000000042A000.00000004.00000001.01000000.00000009.sdmp, Ffmfeg32.exe, 00000008.00000002.1477156948.000000000042A000.00000004.00000001.01000000.0000000A.sdmp, Febcfckp.exe, 00000009.00000002.1478417107.000000000042A000.00000004.00000001.01000000.0000000B.sdmp, Gbfcph32.exe, 0000000A.00000002.1479423300.000000000042A000.00000004.00000001.01000000.0000000C.sdmp, Gbipeg32.exe, 0000000B.00000002.1480045068.000000000042A000.00000004.00000001.01000000.0000000D.sdmp, Gpmqolfa.exe, 0000000C.00000002.1480873068.000000000042A000.00000004.00000001.01000000.0000000E.sdmp, Geiigbeh.exe, 0000000D.00000002.1481733667.000000000042A000.00000004.00000001.01000000.0000000F.sdmp, Gnbnph32.exe, 0000000E.00000002.1482343235.000000000042A000.00000004.00000001.01000000.00000010.sdmp, Gpajjk32.exe, 0000000F.00000002.1483379730.000000000042A000.00000004.00000001.01000000.00000011.sdmp, Genbbb32.exe, 00000010.00000002.1484294341.000000000042A000.00000004.00000001.01000000.00000012.sdmp, Hbbclf32.exe, 00000011.00000002.1485425782.000000000042A000.00000004.00000001.01000000.00000013.sdmp, Hpfcejof.exe, 00000012.00000002.1486750331.000000000042A000.00000004.00000001.01000000.00000014.sdmp, Hphpkjlc.exe, 00000013.00000002.1488083524.000000000042A000.00000004.00000001.01000000.00000015.sdmp, Hloapk32.exe, 00000014.00000002.1490631205.000000000042A000.00000004.00000001.01000000.00000016.sdmp, Iejbnp32.exe, 00000015.00000002.1492067196.000000000042A000.00000004.00000001.01000000.00000017.sdmp

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://tat-neftbank.ru/kkq.php

unknown

Details

Name:	http://tat-neftbank.ru/kkq.php
TargetID:	0
From Memory:	true
Current Path:	C:\Users\user\Desktop\jQ3NFDayJm.exe
Source:	jQ3NFDayJm.exe, 00000000.00000002.1470739378.000000000042A000.00000004.00000001.01000000.00000003.sdmp, Enmknk32.exe, 00000001.00000002.1471644690.000000000042A000.00000004.00000001.01000000.00000004.sdmp, Fnohck32.exe, 00000002.00000002.1472452269.000000000042A000.00000004.00000001.01000000.00000005.sdmp, Fkchmojh.exe, 00000003.00000002.1473368979.000000000042A000.00000004.00000001.01000000.00000006.sdmp, Fekmfd32.exe, 00000005.00000002.1474183172.000000000042A000.00000004.00000001.01000000.00000007.sdmp, Foaacm32.exe, 00000006.00000002.1474948269.000000000042A000.00000004.00000001.01000000.00000008.sdmp, Fmeamaph.exe, 00000007.00000002.1476045755.000000000042A000.00000004.00000001.01000000.00000009.sdmp, Ffmfeg32.exe, 00000008.00000002.1477156948.000000000042A000.00000004.00000001.01000000.0000000A.sdmp, Febcfckp.exe, 00000009.00000002.1478417107.000000000042A000.00000004.00000001.01000000.0000000B.sdmp, Gbfcph32.exe, 0000000A.00000002.1479423300.000000000042A000.00000004.00000001.01000000.0000000C.sdmp, Gbipeg32.exe, 0000000B.00000002.1480045068.000000000042A000.00000004.00000001.01000000.0000000D.sdmp, Gpmqolfa.exe, 0000000C.00000002.1480873068.000000000042A000.00000004.00000001.01000000.0000000E.sdmp, Geiigbeh.exe, 0000000D.00000002.1481733667.000000000042A000.00000004.00000001.01000000.0000000F.sdmp, Gnbnph32.exe, 0000000E.00000002.1482343235.000000000042A000.00000004.00000001.01000000.00000010.sdmp, Gpajjk32.exe, 0000000F.00000002.1483379730.000000000042A000.00000004.00000001.01000000.00000011.sdmp, Genbbb32.exe, 00000010.00000002.1484294341.000000000042A000.00000004.00000001.01000000.00000012.sdmp, Hbbclf32.exe, 00000011.00000002.1485425782.000000000042A000.00000004.00000001.01000000.00000013.sdmp, Hpfcejof.exe, 00000012.00000002.1486750331.000000000042A000.00000004.00000001.01000000.00000014.sdmp, Hphpkjlc.exe, 00000013.00000002.1488083524.000000000042A000.00000004.00000001.01000000.00000015.sdmp, Hloapk32.exe, 00000014.00000002.1490631205.000000000042A000.00000004.00000001.01000000.00000016.sdmp, Iejbnp32.exe, 00000015.00000002.1492067196.000000000042A000.00000004.00000001.01000000.00000017.sdmp

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Registry

Path

Value

Malicious

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad

Web Event Logger